Prototype Pollution

2022-10-1902:58:45

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

browserify-shim

vulnerability

separateexposeglobals

resolve-shims.js

prototype pollution

software

EPSS

0.003

Percentile

71.4%

JSON

browserify-shim is vulnerable to prototype pollution. The vulnerability exists due to the separateExposeGlobals function in resolve-shims.js, which doesn’t restrict __proto__ or constructor keys in the supplied shim which allows an attacker to modify object prototypes.